CVE-2026-1356 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Converter for Media – Optimize images | Convert WebP & AVIF WordPress plugin, specifically in the PassthruLoader::load_image_source function. This flaw allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations, potentially exposing or modifying internal service data. The vulnerability affects all versions up to and including 6.5.1. The CVSS 3.1 base score is 4.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker can exploit this SSRF vulnerability to make the vulnerable server send requests to arbitrary internal or external resources. This can lead to unauthorized information disclosure and modification of data on internal services accessible from the server. There is no indication of availability impact or known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations are provided in the available data.